Fingerprints: Are made up of ridge endings and bifurcations exhibited by the friction ridges and other detailed characteristics that are called minutiae.

Palm Scan: The palm has creases, ridges and grooves throughout it that are unique to a specific person.

Hand Geometry: The shape of a person’s hand (the length and width of the hand and fingers) measures hand geometry.

Retina Scan: Scans the blood-vessel pattern of the retina on the backside of the eyeball.

Iris Scan: Scan the colored portion of the eye that surrounds the pupil.

Signature Dynamics: Electrical signals of speed and time that can be captured when a person writes a signature.

Keyboard Dynamics: Captures the electrical signals when a person types a certain phrase.

Voice Print: Distinguishing differences in people’s speech sounds and patterns.

Facial Scan: Takes attributes and characteristics like bone structures, nose ridges, eye widths, forehead sizes and chin shapes into account.

Hand Topology: Looks at the size and width of an individual’s hand and fingers.

Authentication: The subject is required to provide a second piece to the credential set.

Passwords: Is a protected string of characters that is used to authenticate an individual.

Clipping level:An allowed number of failed logon attempts to happen before a user is locked out.

Password checkers: Test of user-chosen passwords.

Password Generators: Generators that produce users’ passwords.

Password Aging: Expiration dates for passwords.

Limit Login Attempts: Threshold set to allow only a certain number of unsuccessful login attempts.

Cognitive password: Fact or opinion based information used to verify an individual’s identity.

One-time passwords / dynamic password: After the password is used, it is no longer valid.

Token Device: Is a password generator that uses a challenge response scheme.

Synchronous token device: Synchronizes with the authentication service by using time or an event as the core piece of the authentication process.

Time based synchronous token device: The device and the authentication service must hold the exact same time within their internal clocks.

Event-synchronization: The user may need to initiate the logon sequence on the computer and push a button on the token device.

Asynchronous token device: Uses challenge-response scheme to communicate with the authenticate with the authentication service.

Cryptographic Keys: Presenting a private key or a digital signature.

Passphrase: Is a sequence of characters that is longer than a password. The user enters this phrase into an application and the application transforms the value into a virtual password.

Memory Card: A card that holds information, but does not process information.

Smart Card: A card that has the capability of processing information because it has a microprocessor and integrated circuits incorporated into the card itself. A smart card also provides a two-factor authentication method because the user has to enter a user ID and PIN to unlock the smart token.

Granting access to a subject to an object after the object has been properly identified and authenticated.

Need-to-know: Users will only have the necessary rights and permissions they need to fulfil the obligations of their jobs within the company.

Capabilities that would allow a user to enter credentials one time and be able to access all resources in primary and secondary network domains.

Scripting: Batch files and scripts that contain each user’s ID, password and logon commands necessary for each platform.

Because scripts contain credentials, they must be stored in a protected area and the transmission of the scripts must be dealt with carefully.

Uses symmetric key cryptography and provide end-to-end security

Main components

• KDC (Key Distribution Center): Holds all users’ and services’ cryptographic keys. It provides authentication services, as well as key distribution functionality. The KDC provides security services to entities referred to as principals, that can be users, applications or services. A ticket is generated by the KDC and given to a principal when that principal needs to authenticate to another principal. A KDC provides security services for a set of components and principals. This is called realm in Kerberos.


• AS (Authentication Service): Is the part of the KDC that authenticates a principal


• TGS (Ticket Granting): Is the part of KDC that makes the tickets and hands them out to the principals.

• The KDC is a single point of failure


• The AS must be able to handle a huge amount of requests


• Secret keys are temporarily stored on users’ workstations


• Session keys are decrypted and reside on the users’ workstations


• Is vulnerable to password guessing


• Network traffic is not protected


• When a user changes his password, it changes the secret key and the KDS needs to be updated

About the author